CVE-2026-56784
OpenRemote Manager - Cross-Tenant IDOR in Bulk Alarm Deletion
CVSS Score
8.3
EPSS Score
0.0%
EPSS Percentile
0th
OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms() method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong to the caller's realm, enabling cross-tenant permanent destruction of safety-critical and security alerts.
| CWE | CWE-639 |
| Vendor | openremote |
| Product | openremote |
| Published | Jun 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for openremote openremote
Be the first to know when new high vulnerabilities affecting openremote openremote are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High
Affected Versions
openremote / openremote
0 < 1.24.2
References
Credits
🔍 Forklit 🔍 vladkoniakhinmob